Skip to content

ci(deps): bump actions/setup-node from 4 to 6 #277

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci(deps): bump actions/setup-node from 4 to 6 #277

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 11, 2025 •
edited
Loading

Bumps actions/setup-node from 4 to 6.

Release notes

Sourced from actions/setup-node's releases.

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 11, 2025
@dependabot
ci(deps): bump actions/setup-node from 4 to 6
c14e338 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot-github_actions-actions-setup-node-6 branch from 77949e4 to c14e338 Compare November 22, 2025 05:33
@github-actions
Copy link
Contributor

github-actions bot commented Nov 22, 2025

Claude Code Review

Summary

This PR upgrades actions/setup-node from v4 to v6 in the E2E workflow. This is a low-risk dependency update from Dependabot that brings important security fixes and features. The upgrade is safe to merge with one minor consideration regarding automatic caching behavior.

Overall Assessment: ✅ APPROVED - The change is minimal, well-isolated, and the breaking changes in v6 do not negatively impact this repository's workflows.

Issues by Severity

🔵 Minor Issues

1. Automatic npm caching may be redundant but harmless

In v6.0.0, setup-node now automatically detects and enables caching when a packageManager field exists in package.json. However:

  • ✅ Neither e2e/package.json nor components/frontend/package.json have a packageManager field
  • ✅ Explicit cache: 'npm' configuration is still supported and takes precedence
  • ✅ The workflow already explicitly specifies cache-dependency-path, which works correctly in v6

Impact: None. The existing explicit cache configuration (cache: 'npm') will continue to work as expected.

Reference: setup-node v6 release notes state that automatic caching only activates when packageManager field is present in package.json, which is not the case here.

Positive Highlights

✅ Security improvements - v6 includes upgraded dependencies with security fixes (form-data vulnerability fix, undici upgrade)

✅ Consistent upgrade - Both workflows using setup-node are now on v6:

✅ Backward compatible - All existing workflow configurations remain valid:

  • node-version: '20' works correctly
  • cache: 'npm' explicitly specified
  • cache-dependency-path properly configured

✅ Runner compatibility - GitHub-hosted runners (ubuntu-latest) are guaranteed to meet the v2.327.1+ requirement for node24 runtime

✅ Well-tested upstream - setup-node v6 has been stable since October 2024 with no major issues reported

Recommendations

✅ Safe to merge immediately

No action items required. The upgrade is fully compatible with existing workflows.

Optional future optimization (not required for this PR)

Consider adding packageManager: "npm@10.x" to package.json files in the future to leverage v6's automatic package manager detection feature. This would allow:

  • Removal of explicit cache: 'npm' configuration
  • Automatic version pinning of npm itself
  • Alignment with Corepack standards

However, this is purely optional and offers no functional benefit over the current explicit configuration.

Technical Analysis

What changed:

  • Single line: uses: actions/setup-node@v4 → uses: actions/setup-node@v6
  • Scope: E2E test workflow only

Breaking changes in v6 that DON'T affect this repo:

  1. ❌ Automatic caching limited to npm only (we use npm ✅)
  2. ❌ Requires runner v2.327.1+ (GitHub-hosted runners already meet this ✅)
  3. ❌ Requires packageManager field for auto-caching (we don't have it, using explicit cache ✅)

Dependency upgrades included in v6:

  • ts-jest 29.1.2 → 29.4.1
  • prettier 2.8.8 → 3.6.2
  • uuid 9.0.1 → 11.1.0
  • undici 5.28.5 → 5.29.0
  • form-data (critical vulnerability fix)

Testing confidence:

  • ✅ Identical configuration already tested in frontend-lint.yml workflow
  • ✅ No changes to package.json or lock files
  • ✅ No changes to caching behavior (explicit configuration takes precedence)
  • ✅ GitHub Actions will validate on PR

Recommendation: ✅ Approve and merge - This is a routine, safe dependency update with security benefits and no compatibility risks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code priority: low

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dgutride